codiedev 0.9.50 → 0.9.52

package/dist/captureLog.d.ts

@@ -2,7 +2,7 @@ import * as fs from "fs";
 export declare const CAPTURE_LOG_MAX_BYTES: number;
 export declare const CAPTURE_LOG_PATH: string;
 export interface CaptureLogEntry {
-    stage: "capture-finish" | "upload" | "upload-deferred" | "security" | "stderr";
+    stage: "capture-finish" | "upload" | "upload-deferred" | "stderr";
     sessionId: string | undefined;
     outcome: string;
     detail?: string;

package/dist/cli.js

@@ -34,7 +34,6 @@ const share_1 = require("./commands/share");
 const send_1 = require("./commands/send");
 const react_1 = require("./commands/react");
 const capture_1 = require("./commands/capture");
-const security_1 = require("./commands/security");
 const version_1 = require("./version");
 const HELP = `
 Codiedev CLI
@@ -45,13 +44,7 @@ Codiedev CLI
 
 Connect:
   codiedev connect                       Link Claude Code / Codex to your org
-  codiedev doctor                        Verify setup, capture, and Agent Security
-  codiedev security pilot                Run safe synthetic policy checks
-  codiedev security inventory            Inventory MCPs, skills, hooks, plugins,
-                                         instructions, and editor extensions
-  codiedev security scan --deep          Run installed open-source scanners too
-  codiedev security sync                 Fetch administrator policy locally
-  codiedev security rollback --yes       Restore pre-update hook configuration
+  codiedev doctor                        Verify your setup after connecting
 
 Harness:
   codie                                  Launch the governed Codie harness.
@@ -460,9 +453,6 @@ async function main() {
             case "verify":
                 await (0, doctor_1.runDoctor)(rest);
                 return;
-            case "security":
-                await (0, security_1.runSecurityCommand)(rest);
-                return;
             case "push":
                 await (0, push_1.runPush)(rest);
                 return;

package/dist/codie.js

@@ -169,120 +169,6 @@ function installBrandWordmarkUnsafe(runtime) {
             (0, child_process_1.spawnSync)("codesign", ["--force", "--sign", "-", runtime], { stdio: "ignore" });
     }
 }
-async function runNonInteractive(runtime, runtimeArgs, env) {
-    const detached = process.platform !== "win32";
-    const child = (0, child_process_1.spawn)(runtime, runtimeArgs, {
-        stdio: ["pipe", "pipe", "pipe"],
-        env,
-        detached,
-    });
-    if (child.stdin)
-        process.stdin.pipe(child.stdin);
-    const signalChild = (signal) => {
-        if (detached && child.pid) {
-            try {
-                process.kill(-child.pid, signal);
-                return;
-            }
-            catch {
-                // Fall back to the direct child if its process group already exited.
-            }
-        }
-        child.kill(signal);
-    };
-    const forwardInterrupt = () => signalChild("SIGINT");
-    const forwardTermination = () => signalChild("SIGTERM");
-    process.once("SIGINT", forwardInterrupt);
-    process.once("SIGTERM", forwardTermination);
-    return await new Promise((resolve, reject) => {
-        let blockReason;
-        const errorPrefixes = [Buffer.from("\x1b[91m\x1b[1mError:"), Buffer.from("Error: {")];
-        const retainedPrefixBytes = Math.max(...errorPrefixes.map((prefix) => prefix.length)) - 1;
-        // OpenCode's generic UnknownError and the adapter's private reason can be
-        // delivered in either order — and the generic block can arrive on stdout
-        // or stderr. Gate both streams by content, retaining only a possible final
-        // error block. Ordinary output stays streaming apart from the few bytes
-        // needed to recognize a split prefix.
-        const createOutputGate = (write) => {
-            let tail = Buffer.alloc(0);
-            let possibleError;
-            return {
-                push(chunk, blocked) {
-                    if (blocked) {
-                        if (possibleError)
-                            possibleError.push(Buffer.from(chunk));
-                        return;
-                    }
-                    if (possibleError) {
-                        possibleError.push(Buffer.from(chunk));
-                        return;
-                    }
-                    const combined = Buffer.concat([tail, chunk]);
-                    let errorStart = -1;
-                    for (const prefix of errorPrefixes) {
-                        const index = combined.indexOf(prefix);
-                        if (index >= 0 && (errorStart < 0 || index < errorStart))
-                            errorStart = index;
-                    }
-                    if (errorStart >= 0) {
-                        if (errorStart > 0)
-                            write(combined.subarray(0, errorStart));
-                        possibleError = [combined.subarray(errorStart)];
-                        tail = Buffer.alloc(0);
-                        return;
-                    }
-                    const flushBytes = Math.max(0, combined.length - retainedPrefixBytes);
-                    if (flushBytes > 0)
-                        write(combined.subarray(0, flushBytes));
-                    tail = combined.subarray(flushBytes);
-                },
-                finish(blocked) {
-                    if (tail.length > 0)
-                        write(tail);
-                    const heldError = possibleError ? Buffer.concat(possibleError).toString() : "";
-                    const genericBlockError = heldError.includes("UnknownError") &&
-                        heldError.includes("Unexpected server error");
-                    if (heldError && (!blocked || !genericBlockError))
-                        write(heldError);
-                },
-            };
-        };
-        const stdoutGate = createOutputGate((chunk) => process.stdout.write(chunk));
-        const stderrGate = createOutputGate((chunk) => process.stderr.write(chunk));
-        child.stdout?.on("data", (chunk) => {
-            stdoutGate.push(Buffer.from(chunk), Boolean(blockReason));
-        });
-        child.stderr?.on("data", (chunk) => {
-            const text = chunk.toString();
-            const reason = (0, codieLauncher_1.extractCodieSecurityBlock)(text);
-            if (reason) {
-                blockReason = reason;
-                signalChild("SIGTERM");
-                return;
-            }
-            stderrGate.push(Buffer.from(chunk), Boolean(blockReason));
-        });
-        child.once("error", (error) => {
-            if (child.stdin)
-                process.stdin.unpipe(child.stdin);
-            process.removeListener("SIGINT", forwardInterrupt);
-            process.removeListener("SIGTERM", forwardTermination);
-            reject(error);
-        });
-        child.once("close", (status) => {
-            if (child.stdin)
-                process.stdin.unpipe(child.stdin);
-            process.removeListener("SIGINT", forwardInterrupt);
-            process.removeListener("SIGTERM", forwardTermination);
-            stdoutGate.finish(Boolean(blockReason));
-            stderrGate.finish(Boolean(blockReason));
-            if (blockReason) {
-                console.error(`Codie Security blocked this action:\n${blockReason}`);
-            }
-            resolve(status);
-        });
-    });
-}
 async function main() {
     (0, codieRuntime_1.assertCodieNodeVersion)(process.versions.node);
     const connected = connectedCodiedevConfig();
@@ -346,13 +232,6 @@ async function main() {
         OPENCODE_CONFIG_CONTENT: JSON.stringify(config),
     };
     const runtimeArgs = (0, codieLauncher_1.withCodieWorkingDirectory)(parsed.args, process.cwd());
-    const nonInteractiveRun = runtimeArgs[0] === "run";
-    if (nonInteractiveRun)
-        env.CODIEDEV_SECURITY_BLOCK_OUTPUT = "marker";
-    if (nonInteractiveRun) {
-        process.exitCode = (await runNonInteractive(runtime, runtimeArgs, env)) ?? 1;
-        return;
-    }
     const result = (0, child_process_1.spawnSync)(runtime, runtimeArgs, { stdio: "inherit", env });
     if (result.error)
         throw result.error;

package/dist/codieLauncher.d.ts

@@ -2,11 +2,6 @@ export interface CatalogModel {
     id: string;
     name?: string;
 }
-export declare const CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
-/** Extract the private adapter marker used to carry a local block reason
- * across OpenCode's generic 500 boundary. The marker never contains prompt or
- * tool input — only the deterministic policy reason. */
-export declare function extractCodieSecurityBlock(stderr: string): string | undefined;
 /**
  * Pin non-interactive runs to the directory where `codie` was launched.
  * OpenCode can reuse a previously-known project instance; without an explicit

package/dist/codieLauncher.js

@@ -42,8 +42,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = exports.CODIE_SECURITY_BLOCK_MARKER = void 0;
-exports.extractCodieSecurityBlock = extractCodieSecurityBlock;
+exports.HIDDEN_WORDMARK = exports.CODIEDEV_WORDMARK = exports.LEGACY_CODIEDEV_WORDMARK = exports.STOCK_WORDMARK = exports.BRAND_PLUGIN_SPEC = void 0;
 exports.withCodieWorkingDirectory = withCodieWorkingDirectory;
 exports.bareModel = bareModel;
 exports.buildCodieConfig = buildCodieConfig;
@@ -63,26 +62,6 @@ const DEFAULT_NAMES = {
     "z-ai/glm-5.2": "GLM 5.2 · Fireworks ZDR",
     "moonshotai/kimi-k2.7-code": "Kimi K2.7 Code · Fireworks ZDR",
 };
-exports.CODIE_SECURITY_BLOCK_MARKER = "__CODIEDEV_SECURITY_BLOCK__";
-/** Extract the private adapter marker used to carry a local block reason
- * across OpenCode's generic 500 boundary. The marker never contains prompt or
- * tool input — only the deterministic policy reason. */
-function extractCodieSecurityBlock(stderr) {
-    for (const line of stderr.split(/\r?\n/)) {
-        const markerIndex = line.indexOf(exports.CODIE_SECURITY_BLOCK_MARKER);
-        if (markerIndex < 0)
-            continue;
-        try {
-            const parsed = JSON.parse(line.slice(markerIndex + exports.CODIE_SECURITY_BLOCK_MARKER.length));
-            if (typeof parsed?.reason === "string" && parsed.reason.trim())
-                return parsed.reason.trim();
-        }
-        catch {
-            // Ignore malformed or foreign stderr and preserve the original runtime error.
-        }
-    }
-    return undefined;
-}
 /**
  * Pin non-interactive runs to the directory where `codie` was launched.
  * OpenCode can reuse a previously-known project instance; without an explicit

package/dist/commands/doctor.js

@@ -45,8 +45,6 @@ const version_1 = require("../version");
 const upgradeNudge_1 = require("../upgradeNudge");
 const captureReadiness_1 = require("../captureReadiness");
 const captureLog_1 = require("../captureLog");
-const securityDoctor_1 = require("../securityDoctor");
-const securityFeature_1 = require("../securityFeature");
 const CLAUDE_SETTINGS_PATH = path.join(os.homedir(), ".claude", "settings.json");
 const CLAUDE_INSTRUCTIONS_PATH = path.join(os.homedir(), ".claude", "CLAUDE.md");
 const CODEX_HOOKS_PATH = path.join(os.homedir(), ".codex", "hooks.json");
@@ -484,12 +482,6 @@ async function runDoctor(_args) {
             detail: "not installed on this machine",
         });
     }
-    // Agent Security is part of installation health, not a separate setup
-    // concept. Keep `codiedev security doctor` as an alias for focused output,
-    // while the main doctor remains the one command users need to remember.
-    if ((0, securityFeature_1.isAgentSecurityEnabled)(config)) {
-        checks.push(...(0, securityDoctor_1.securityDoctorChecks)((0, securityDoctor_1.collectSecurityDoctorReport)(config.companyId)));
-    }
     // 8. gh / glab CLIs (optional — only needed for reverse-ticket from a
     // specific PR/MR URL; branch mode works without either).
     checks.push({

package/dist/connect.js

@@ -39,16 +39,11 @@ const https = __importStar(require("https"));
 const http = __importStar(require("http"));
 const crypto = __importStar(require("crypto"));
 const os = __importStar(require("os"));
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
 const utils_1 = require("./utils");
 const connectFlow_1 = require("./connectFlow");
 const version_1 = require("./version");
 const upgradeNudge_1 = require("./upgradeNudge");
 const shared_1 = require("./commands/shared");
-const securityInstall_1 = require("./securityInstall");
-const securityPolicy_1 = require("./securityPolicy");
-const securityFeature_1 = require("./securityFeature");
 // cli.codiedev.com is a Convex custom domain on the prod deployment; the
 // underlying judicious-falcon-861.convex.site URL keeps serving, so configs
 // written by older CLI versions stay valid without a re-connect.
@@ -205,7 +200,6 @@ async function runConnect(args = []) {
     // Extract fields from response
     const companyId = responseData.companyId;
     const companyName = responseData.companyName;
-    const agentSecurityEnabled = responseData.agentSecurityEnabled === true;
     const repos = responseData.repos ?? [];
     if (!companyId || !companyName) {
         console.error("\nError: Invalid response from server. Token may be invalid.");
@@ -218,7 +212,6 @@ async function runConnect(args = []) {
         repos,
         lastSynced: new Date().toISOString(),
         backendUrl: BACKEND_URL,
-        agentSecurityEnabled,
         deviceId: saved?.deviceId || crypto.randomUUID(),
         deviceName: saved?.deviceName || os.hostname(),
         captureIgnoredPaths: saved?.captureIgnoredPaths ?? [],
@@ -287,16 +280,6 @@ async function runConnect(args = []) {
     // /api/cli/markInstalled so the portal's "Connected" state reflects
     // what's actually wired up on this machine, not just "token validated."
     const installedTargets = [];
-    const home = os.homedir();
-    const securityConfigPaths = [
-        path.join(home, ".claude", "settings.json"),
-        path.join(home, ".codex", "hooks.json"),
-        path.join(home, ".config", "opencode", "plugins", "codiedev.js"),
-        path.join(home, ".codex", "config.toml"),
-    ];
-    // Snapshot before any hook update. Rollback is intentionally not automatic:
-    // an administrator can inspect these 0600 copies before restoring them.
-    const securitySnapshot = (0, securityInstall_1.createSecurityInstallSnapshot)(securityConfigPaths);
     // Wrap each per-target write so we emit one install_target row each. The
     // existing user-visible behavior (console.warn on failure, continue) is
     // unchanged — telemetry just observes the outcome.
@@ -319,11 +302,11 @@ async function runConnect(args = []) {
         }
     };
     if (hasClaude) {
-        runInstall("claude-code-hook", () => (0, utils_1.installHook)(agentSecurityEnabled), "Claude Code SessionEnd (capture) + UserPromptSubmit (skill discovery) + Stop (auto-backup) hooks (~/.claude/settings.json)", "claudeCode-hook");
+        runInstall("claude-code-hook", utils_1.installHook, "Claude Code SessionEnd (capture) + UserPromptSubmit (skill discovery) + Stop (auto-backup) hooks (~/.claude/settings.json)", "claudeCode-hook");
         runInstall("claude-code-instructions", utils_1.installClaudeCodeInstructions, "Claude Code agent instructions (~/.claude/CLAUDE.md)", "claudeCode-instructions");
     }
     if (hasCodex) {
-        runInstall("codex-hook", () => (0, utils_1.installCodexHook)(agentSecurityEnabled), "Codex Stop (capture + auto-backup) hooks (~/.codex/hooks.json)", "codex-hook");
+        runInstall("codex-hook", utils_1.installCodexHook, "Codex Stop (capture + auto-backup) hooks (~/.codex/hooks.json)", "codex-hook");
         runInstall("codex-instructions", utils_1.installCodexInstructions, "Codex agent instructions (~/.codex/AGENTS.md)", "codex-instructions");
     }
     if (hasCursor) {
@@ -333,36 +316,7 @@ async function runConnect(args = []) {
     // Always stage the adapter. It is dormant until OpenCode starts, which lets
     // a user connect Claude Code today and install the Codie harness tomorrow
     // without needing a second setup ritual.
-    runInstall("opencode-capture-adapter", () => (0, utils_1.installOpenCodeCapturePlugin)(agentSecurityEnabled), "OpenCode session capture adapter (~/.config/opencode/plugins/codiedev.js)", "opencode-capture");
-    // Record the exact installed hook bytes and the pre-update rollback files.
-    // This supplies health/integrity checks without requiring a package publish
-    // or trusting whichever `node` happens to be first on PATH later.
-    try {
-        const hookScriptPath = path.join(__dirname, "hook.js");
-        if (agentSecurityEnabled && fs.existsSync(hookScriptPath)) {
-            const targets = [];
-            if (installedTargets.includes("claudeCode-hook"))
-                targets.push({ surface: "claude-code", configPath: securityConfigPaths[0] });
-            if (installedTargets.includes("codex-hook"))
-                targets.push({ surface: "codex", configPath: securityConfigPaths[1] });
-            if (installedTargets.includes("opencode-capture"))
-                targets.push({ surface: "codie-harness", configPath: securityConfigPaths[2] });
-            (0, securityInstall_1.writeSecurityInstallManifest)({ hookScriptPath, snapshot: securitySnapshot, targets });
-        }
-    }
-    catch (err) {
-        console.warn(`Warning: Security hooks installed, but integrity manifest could not be written — ${err.message}`);
-    }
-    // Prime the local cache after installation. Hooks read this file only, so
-    // an endpoint decision never depends on live network latency.
-    if (agentSecurityEnabled) {
-        try {
-            await (0, securityPolicy_1.syncEndpointSecurityPolicy)(config);
-        }
-        catch (err) {
-            console.warn(`Warning: Agent-security policy will use safe defaults until sync succeeds — ${err.message}`);
-        }
-    }
+    runInstall("opencode-capture-adapter", utils_1.installOpenCodeCapturePlugin, "OpenCode session capture adapter (~/.config/opencode/plugins/codiedev.js)", "opencode-capture");
     // Tell the backend which targets we wired up so the portal's onboarding
     // card flips to "Connected" only when something actually installed —
     // not on bare token validation. Best-effort: a network failure here
@@ -401,8 +355,5 @@ async function runConnect(args = []) {
     }
     console.log();
     console.log("Run `codiedev doctor` to verify everything's wired up.");
-    if ((0, securityFeature_1.isAgentSecurityEnabled)(config)) {
-        console.log("Run `codiedev security pilot` to validate blocking safely.");
-    }
     console.log();
 }